From 04c8081215762069284fd18b6908eafaf7a3d67c Mon Sep 17 00:00:00 2001 From: Cedric Date: Tue, 27 Oct 2026 15:48:15 +0100 Subject: [PATCH] =?UTF-8?q?Domaine=20bwpoc.vlab.bzh=20derri=C3=A8re=20le?= =?UTF-8?q?=20Traefik=20de=20vlab.bzh,=20correctif=20de=20la=20r=C3=A8gle?= =?UTF-8?q?=20d'acc=C3=A8s=20r=C3=A9serv=C3=A9=20(cha=C3=AEne=20ModSecurit?= =?UTF-8?q?y)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Tests : 26 OK, 0 KO. Co-Authored-By: Claude Opus 5.5 (1M context) --- README.md | 2 +- inventory/group_vars/all.yml | 6 +++--- roles/bunkerweb/templates/compose.yml.j2 | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index d53533a..77492e8 100644 --- a/README.md +++ b/README.md @@ -256,7 +256,7 @@ Si 80/443 sont déjà pris par un Traefik, il termine le TLS public (ses propres http: routers: bwpoc: - rule: "Host(`www.lab.naoned.net`) || Host(`shop.lab.naoned.net`) || Host(`api.lab.naoned.net`) || Host(`bwui.lab.naoned.net`)" + rule: "Host(`www.bwpoc.vlab.bzh`) || Host(`shop.bwpoc.vlab.bzh`) || Host(`api.bwpoc.vlab.bzh`) || Host(`bwui.bwpoc.vlab.bzh`)" entryPoints: [websecure] service: bwpoc tls: { certResolver: letsencrypt } diff --git a/inventory/group_vars/all.yml b/inventory/group_vars/all.yml index 08439d9..515af2a 100644 --- a/inventory/group_vars/all.yml +++ b/inventory/group_vars/all.yml @@ -7,7 +7,7 @@ # --- Domaine de test ------------------------------------------------- # Les sites seront www., shop., api., bwui. # ".internal" est réservé par l'ICANN pour l'usage privé : pas de collision possible. -poc_domain: bwpoc.internal # A ADAPTER si vous avez une zone DNS de labo +poc_domain: bwpoc.vlab.bzh # A ADAPTER : bwpoc.internal pour un labo fermé (wildcard *.vlab.bzh -> Traefik) # --- TLS ---------------------------------------------------------------- # selfsigned : certificats auto-signés (labo fermé, domaine non public) @@ -19,13 +19,13 @@ poc_letsencrypt_staging: false # true pour tester sans consommer les quot # Reverse proxy en frontal (Traefik, HAProxy...) qui termine le TLS public et relaie vers # le WAF (https://:443, certificat auto-signé à accepter côté proxy) : ses IP, pour # que BunkerWeb prenne l'IP réelle du client dans X-Forwarded-For (bans, limites, listes). -poc_trusted_proxies: [] # ex. ["192.168.200.10"] +poc_trusted_proxies: ["172.16.16.21"] # Traefik de vlab.bzh ; [] sans reverse proxy # --- Exposition publique ------------------------------------------------ # Sites réservés à certaines IP sources (403 pour les autres, sauf challenge ACME). # Le client de test du PoC est toujours autorisé. Liste vide = pas de restriction. poc_restricted_sites: [bwui] -poc_allowed_sources: [] # ex. ["203.0.113.10", "198.51.100.0/24"] +poc_allowed_sources: ["172.16.0.0/12", "192.168.0.0/16"] # réseaux privés ; ajouter ses IP publiques # --- Proxmox ---------------------------------------------------------- pve_node: lancelot diff --git a/roles/bunkerweb/templates/compose.yml.j2 b/roles/bunkerweb/templates/compose.yml.j2 index 0b07b75..eb70232 100644 --- a/roles/bunkerweb/templates/compose.yml.j2 +++ b/roles/bunkerweb/templates/compose.yml.j2 @@ -69,7 +69,7 @@ services: {% if name in poc_restricted_sites and poc_allowed_sources | length > 0 %} # Accès réservé (poc_allowed_sources + client de test), challenge ACME toujours permis {{ fqdn }}_CUSTOM_CONF_MODSEC_poc-allowlist: {{ val('SecRule REMOTE_ADDR "!@ipMatch ' ~ ((poc_allowed_sources + [client_ip]) | join(',')) ~ '" "id:10002,phase:1,deny,status:403,log,msg:\'PoC BunkerWeb : source non autorisee\',chain" -SecRule REQUEST_URI "!@beginsWith /.well-known/acme-challenge/"') }} +SecRule REQUEST_URI "!@beginsWith /.well-known/acme-challenge/" "t:none"') }} {% endif %} {% endfor %} networks: